Responsibilities, Ethics, and Regulations for Human Subjects Research

The principal investigator (PI) is responsible for personally conducting and/or supervising the conduct of human-subjects research and for protecting the rights, safety, and welfare of the subjects enrolled in the research.

The Investigator is accountable for regulatory violations resulting from failure to adequately supervise the conduct of the study.

More Specifically, the Principal Investigator Must:

• Design and implement ethical research, consistent with the principles outlined in the Belmont Report
• Ensure that all research involving human subjects is submitted to and approved by the IRB before study initiation
• Ensure that anyone delegated to conduct study-related tasks is qualified and trained appropriately
• Ensure adequate supervision of any and all co-investigators and study staff
• Ensure that informed consent is obtained prior to initiating study activities
• Implement research as it has been approved by the IRB
• Obtain prior IRB approval before implementing study changes
• Obtain informed consent/assent in accordance with the IRB approved application
• Document informed consent/assent as outlined in the IRB approved application
• Report progress of the approved protocol as often as required by the IRB
• Report any new information of risks, adverse events, unanticipated problems etc., as outlined in the IRB policies
• Ensure that a final report is submitted to the IRB when the study is closed or completed
• Retain research records for a minimum of 7 years (information can be stored off-site)

The investigator should develop a plan for the supervision and oversight of the study. This plan should include the following as applicable:

• Routine meetings with staff to review trial progress, adverse events, and update staff on any changes to the protocol or other procedures
• A procedure for the timely correction and documentation of problems identified by study personnel, outside auditors, or other parties involved in the conduct of a study
• A procedure for documenting or reviewing the performance of delegated tasks in a satisfactory and timely manner (e.g., observation of the performance of selected assessments or independent verification by repeating selected assessments)
• A procedure for ensuring that the consent process is being conducted in accordance with the IRB-approved protocol and applicable regulations and laws AND that study subjects understand the nature of their participation and the risks
• A procedure for ensuring that source data are accurate
• A procedure for ensuring that information in source documents is accurately captured on the case report forms (CRFs)
• A procedure for dealing with discrepancies identified by staff or outside auditors

Qualitative research is a method of inquiry employed in many different academic disciplines. The purpose of qualitative research is to gather an in-depth understanding of human behavior and the reasons that govern such behavior. (source)

Examples of Qualitative Research

• Ethnography
• Marketing
• Oral Histories
• Community Based Participatory

• Observing Participants
• Focus Groups
• Participant Interviews
• Open-ended Survey Questions
• Photos

Reducing Risks*

In order to approve a submission, the IRB needs to make federally-mandated determinations about each submission, based on the information provided in the IRB application.

Investigators can assist in the efficiency of the IRB submission review process by making sure the IRB application includes a clear plan for how risks will be minimized. Especially regarding Breach of Confidentiality, Violations of Privacy, and understanding Reportable Events.

*Source – Adapted, in part, from the Institutional Review Board Member Handbook. Third Edition. Robert Amdur and Elizabeth A. Bankert

• National Human Research Protections Advisory Committee (NHRPAC), Clarification of the Status of Third Parties When Referenced by Human Subjects in Research, April 2002.
• The National Human Research Protections Advisory Committee (NHRPAC) July, 2002 – Recommendations on Confidentiality and Research Data Protections
• National Science Foundation
• American Anthropological Association – Ethics Committee

Over the course of conducting a study, investigators may encounter situations or events that need to be reported to the IRB.

Examples of events that require IRB reporting include (not limited to):

• New Information indicating a change to the risks or potential benefits of the research
• Deviation from approved protocol
• Subject complaint
• Incarceration of a subject
• Adverse event
• Unanticipated problem involving risks to subjects or others

For more information regarding reporting events to the IRB, please refer to the following:

• Federal and state regulations & guidance

Depending on the nature of the study, investigators may encounter situations that are considered reportable events. Child or elder abuse or neglect are examples of reportable events.

In some professions, reporting of these events is mandated by law. For example, public educators and many health care professionals are mandatory reporters. Investigators need to be aware of the laws and regulations within the state or country the research is taking place so that they can comply with their reporting responsibilities.

Study participants need to be made aware of any reporting responsibilities that the investigator must adhere to. This can be done during the informed consent process and outlined in the consent document.

In many qualitative social science research, investigators collect detailed information about a study participant’s life, experiences and perceptions. If this information is maintained in a confidential manner and is inadvertently disclosed to others, the study participant might become embarrassed or experience other harms.

While all study data should be kept confidential, some research data might require higher levels of data protection. Investigators should evaluate the data being collected in the context of the social setting and address measures for data security.

Please review Boston University’s Data Protection Standards for more information. In addition, Information Security at Boston University also offers a free full-disk encryption service. Please contact Quinn Shamblin, Executive Director of Information Security, Boston University at qrs@bu.edu for more information.

Individuals have a right to control the extent, timing and circumstances of information shared about themselves with others. In a research setting, investigators have an obligation to protect the privacy of study participants.

If research is conducted in the United States and the disclosure of the research data might put the participant at risk of adverse consequences (for example, damage to financial standing, employability, reputation, insurance etc.) investigators can apply for a Certificate of Confidentiality to help protect against forced disclosure (for example, through a subpoena).

Examples of Information that May be Considered Sensitive

• Information relating to sexual attitudes, preferences, or practices;
• Information relating to the use of alcohol, drugs, or other addictive products;
• Information pertaining to illegal conduct;
• Information that if released could reasonably be damaging to an individual’s financial standing, employability, or reputation within the community;
• Information pertaining to an individual’s psychological well-being or mental health;
• Information about genetic information;
• Information in other categories not listed may also be considered sensitive because of specific cultural or other factors, and protection can be granted in such cases upon appropriate justification and explanation

Certificates of Confidentiality (COCs) are issued by the National Institutes of Health (NIH) to protect identifiable research information from forced disclosure. They allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level.

Identifying information is broadly defined as any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

By protecting investigator and institutions from being compelled to disclose information that would identify research subjects, Certificates of Confidentiality help achieve the research objectives and promote participation in studies by helping assure confidentiality and privacy to participants (source DHHS).

Subjects should be informed of the protections afforded to them by the COC and any exceptions to those protections. Investigators should include language in the consent form that addresses the purpose of the COC and any limitations/exclusions.

Examples of language:

To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. With this Certificate, the investigator cannot be forced to disclose information that may identify you, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings.
Exceptions: A Certificate of Confidentiality does not prevent investigator from voluntarily disclosing information about you, without your consent. For example, we will voluntarily disclose information about incidents such as child abuse, and intent to hurt yourself or others.
In addition, a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the investigator may not use the Certificate to withhold that information.
Finally, the Certificate may not be used to withhold information from the Federal government needed for auditing or evaluating Federally funded projects or information needed by the FDA.

Certificates of Confidentiality do not take the place of good data security or clear policies and procedures for data protection which are essential to the protection of research participants’ privacy.

Investigators should take appropriate steps to safeguard research data and findings.

A COC can be used for clinical, behavioral, biomedical, social or other types of research that collect sensitive information. Research may be considered sensitive if disclosure of that information could have adverse consequences for the subject or damage their financial standing, employability, insurability, or reputation.

There are certain instances where the information is so sensitive that the IRB feels it is in the best interest of the subject to apply for a COC.

However, in many cases, it might be sufficient to inform potential subjects of the possibility of forced disclosure of sensitive information to outside parties.

First, you should identify if a COC is appropriate for your research. When the research is of a sensitive nature where the protection is judged necessary to achieve the research objectives, a certificate of confidentiality should be sought.

If the data being collected is considered sensitive and you wish to add this layer of additional protection to the data:

1. Inform the IRB of your plans to apply for a COC in your IRB application.
2. Submit two versions of your consent form. One version should not contain any language referring to holding a certificate of confidentiality. The other version should contain the language you plan to use regarding holding a certificate of confidentiality. Upon approval of your submission, the IRB will stamp the consent form that does not contain the COC language. You may use this consent form to get started with your research. The IRB will make a notation in your approval letter that the IRB approves the use of a COC.
3. NIH’s kiosk. Please note that the NIH requires verification of IRB approval and a signature from Kathryn Mellouk, who is the Institutional Official for the Charles River Campus IRB at BU.
4. Once the COC is obtained, investigators should submit an amendment to the IRB to have the version of the consent form that includes COC language approved for use.

An application for a Certificate of Confidentiality does not guarantee that one will be issued. Research that might not be granted a COC:

• Not research based
• Not approved by an IRB operating under either an approved Federalwide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration
• Not collecting sensitive information or information that, if released publicly, might harm the research participants
• Not collecting personally identifiable information, or
• Not involving a subject matter that is within a mission area of the National Institutes of Health

On COCs:

NIH Certificate of Confidentiality Kiosk (where investigators can get started with a COC application)

NIH Announces Statement on COCs

Federal and State Regulation Resources:

The Federal Regulations link includes the regulations that govern human subjects research. There are two separate sets of regulations: one from Health and Human Services and one from the FDA (which govern any research under the purview of FDA).

• HHS Regulations
• FDA Regulations
• HHS and FDA Regulations Compared

• Clinical Trials
• Office of Research Integrity
• Certificate of Confidentiality Kiosk
• Certificate of Confidentiality Background
• NIH Data Sharing Information
• National Science Foundation Data Sharing
• NIH’s Office of Behavioral and Social Science Research
• National Science Foundation
• Office of Justice Programs
• United States Department of Education
• International Association of Bioethics
• International Conference on Harmonisation
• The New England Translators Association

Clinical Trials Registration

https://clinicaltrials.gov/

The consent form or study information sheet is a document used to guide your consenting process. The consent form should include several sections, which are called “elements.”

In order to help investigators create a consent document that includes all of the necessary elements, and is more readable, the IRB has created consent / assent form templates. We recommend that investigators use the templates OR use them as a guide in creating a consent document.

To get a sense of how the IRB reviews consent forms, please review the Consent Form Review Checklist. This document is used by the IRB reviewers when reviewing submissions and can be used as a guide when preparing your consent document.

If you are submitting an Exempt application, be sure your consent form or information sheet includes the following:

• The purpose of the research study and how the results will be used (if this is a student protocol indicate that the investigator is a student, list the school, note that the research is part of a thesis/dissertation work);
• A statement that participation is completely voluntary, and that subjects can stop at any time;
• If BU students will be enrolled, add the following statement: “You may choose not to be in the study or to stop being in the study before it is over at any time. This will not affect your class standing or your grades at Boston University. You will not be offered or receive any special consideration if you take part in this research study.”
• Approximately how much time will be needed to complete any surveys;
• That all responses are confidential;
• Who subjects can contact if they have any questions and how this person can be contacted (if this is a student protocol add the name and contact email for the student’s advisor also);
• The following statement: *You may obtain further information about your rights as a research subject by calling the BU CRC IRB Office at 617-358-6115.”

Important Note – To further protect the confidentiality and privacy of subjects, a signature line on the consent form is not required for Exempt studies. If there is a specific reason why an investigator wishes to retain a signature line, please state so in the IRB application.

If you are submitting an expedited or full board study, there are several required elements for the consent document.

Required* elements include:

• A statement that the study involves research;
• An explanation of the purposes of the research;
• The expected duration of the subject’s participation;
• A description of the procedures to be followed;
• Identification of any procedures which are experimental;
• A description of any reasonably foreseeable risks or discomforts to the subject;
• A description of any benefits to the subject or to others which may reasonably be expected from the research;
• A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;
• A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;
• For research involving more than minimal risk, an explanation as to whether any compensation, and an explanation as to whether any medical treatments are available, if injury occurs and, if so, what they consist of, or where further information may be obtained;
• An explanation of whom to contact for answers to pertinent questions about the research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject;
• A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits, to which the subject is otherwise entitled

Additional elements, as appropriate:

• A statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant), which are currently unforeseeable;
• Anticipated circumstances under which the subject’s participation may be terminated by the investigator without regard to the subject’s consent;
• Any additional costs to the subject that may result from participation in the research;
• The consequences of a subject’s decision to withdraw from the research and procedures for orderly termination of participation by the subject;
• A statement that significant new findings developed during the course of the research, which may relate to the subject’s willingness to continue participation, will be provided to the subject;
• The approximate number of subjects involved in the study

*Please note, in very specific situations, the IRB may approve a consent procedure which does not include, or which alters, some or all of the elements of informed consent set forth above, or waive the requirement to document informed consent.

• Use words familiar to the non-academic/non-scientific reader
• Avoid abbreviations and acronyms if possible (if using, spell out when first used)
• Avoid contractions
• Avoid long words with many syllables
• Avoid unnecessary adjectives
• Avoid legal jargon
• Use active verbs
• Use the second person (you) not third person (the participant) to increase personal identification
• Use a conversational tone
• Use headings and subheading to group text together
• Standardize the layout throughout the document (for example, use the same typeface, size, etc.)
• Write short, simple, and direct sentences
• Avoid using e.g. or etc., use instead, “for example,” “so forth”
• Divide sentences into two when necessary
• Keep paragraphs short and limited to one idea
• Use page numbers, if appropriate
• Use at least 12-point font and consider a larger font based on your audience
• Check the text to see if each idea is clear and logically sequential
• Avoid repetition
• Avoid large blocks of printed text and embrace “white space”
• Use photos or pictures if they will help clarify procedures
• Be consistent with use of all terminology, such as procedures or treatment names and abbreviations

The HIPAA Privacy Rule protects the privacy of “protected health information” (PHI). The HIPAA Security Rule safeguards PHI that is in electronic form. The HIPAA Security rule defines 18 identifiers (listed below) and details standards for protecting, storing, accessing, transmitting and auditing PHI.

1. Names;
2. All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code in certain situations;
3. All elements of date (except year) for dates directly related to an individual, including birth date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
4. Telephone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints;
17. Full face photographic images and any comparable images; and
18. Any other unique identifying number, characteristic, or code

• The Belmont Report
• American Anthropological Association Professional Ethics
• Online Ethics Center (Center for Engineering, Ethics and Society)
• The Nuremberg Code
• Declaration of Helsinki (1964)